HID PlayStation Driver Touch Report Array Overflow

Executive Summary

This vulnerability exists in the Linux kernel's handling of PlayStation controller touch reports. Specifically, the function dualshock4_parse_report processes touch input data from the device. If a device falsely reports the number of touch reports, the function may read beyond the allocated touch_reports array, potentially up to about 2 KiB of memory. This happens because the loop iterates up to the reported number of touch reports without proper validation. The vulnerability is mitigated by clamping the num_touch_reports value to the maximum size of the touch_reports array, preventing out-of-bounds reads.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could cause the Linux kernel to read memory beyond the intended buffer when processing touch input from a PlayStation controller. This out-of-bounds read could potentially expose sensitive kernel memory data or cause system instability. The data read might be emitted via the evdev interface, which could lead to unintended information disclosure or other unpredictable behavior.

Useful 0 Not Useful 0